CVE-2020-37282Published
office-converter through 1.0.2 OS Command Injection via fileName in generatePdf
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2020-37282 · Microsoft / collected KEV context
cve-program · CVE-2020-37282
- https://github.com/advisories/GHSA-9p64-h5q4-phpm
- https://github.com/vworld4u/office-converter/pull/9
- https://github.com/vworld4u/office-converter/blob/b1ea855d0001dc7a5d66343698634dbc06b72c2d/index.js#L19-L20
- https://www.vulncheck.com/advisories/office-converter-through-1.0.2-os-command-injection-via-filename-in-generatepdf
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.